# Disclosure of all uploads to Cloudinary via hardcoded api secret in Android app

Hardcoded Cloudinary API secret in Reverb's Android app let anyone read, replace, and delete all stored uploads and query account usage stats.

- Payout: hidden
- Severity: medium
- Program: Reverb.com
- Found by: bagipro
- Disclosed: 2018-09-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/351555
- Library page: https://bugbountylibrary.com/r/h1%3A351555
- Tags: area:mobile domain:cloud domain:mobile impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Android app (CloudinaryFacade.java) / Cloudinary API
**Root cause:** The Android app embedded a full Cloudinary config URL including the API key and secret in a static field, contrary to Cloudinary's guidance to ship only the cloud_name.
**Steps:**
1. Decompile the Reverb Android APK and inspect `com/reverb/app/CloudinaryFacade.java`
2. Find `private static final java.lang.String CONFIG = "cloudinary://434762629765715:<secret>@reverb";`
3. Use the key:secret as basic auth against `https://api.cloudinary.com/v1_1/reverb/...` endpoints
4. List/read/replace/delete stored resources and fetch `https://api.cloudinary.com/v1_1/reverb/usage` for account statistics
**How found:** Code review of the decompiled Android app revealed the full Cloudinary config string with credentials in a static constant.
**Exploitation:** Attacker extracts the embedded Cloudinary key/secret from the APK and authenticates to the Cloudinary Admin API for the 'reverb' cloud, gaining read, replace, delete, and settings-change capability over all stored media plus usage statistics.
**Insight:** Decompiled mobile apps often embed third-party SDK config strings; grep for URI-style credential patterns like `scheme://key:secret@cloud` and test them against the vendor's admin API, not just the CDN.